Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit aadaf5c1 authored by Chris Manton's avatar Chris Manton Committed by Automerger Merge Worker
Browse files

security: Use-After-Free in btm_sec_[dis]connected am: 0f71a628 am: 1eb04687 

Original change: https://android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/1975188

Change-Id: Ic12eb7a52658fe24d0f82444535d46ebf6f4969f
parents 0a1f4964 1eb04687

system/stack/btm/btm_sec.cc

+1 −1
Original line number Diff line number Diff line
@@ -3378,7 +3378,6 @@ static void btm_sec_connect_after_reject_timeout(UNUSED_ATTR void* data) { 
void btm_sec_connected(const RawAddress& bda, uint16_t handle,

                       tHCI_STATUS status, uint8_t enc_mode,

                       tHCI_ROLE assigned_role) {

  tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bda);

  tBTM_STATUS res;

  bool is_pairing_device = false;

  bool addr_matched;
@@ -3386,6 +3385,7 @@ void btm_sec_connected(const RawAddress& bda, uint16_t handle, 


  btm_acl_resubmit_page();



  tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bda);

  if (!p_dev_rec) {

    LOG_DEBUG(

        "Connected to new device state:%s handle:0x%04x status:%s "